{"schemaVersion":3,"id":"CVE-2024-47575","aliases":[],"status":"published","duplicateOf":null,"title":"Fortinet FortiManager Missing Authentication Vulnerability","description":"A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.12, FortiManager Cloud 6.4.1 through 6.4.7 allows attacker to execute arbitrary code or commands via specially crafted requests.","dates":{"published":"2024-10-23T15:03:48.798Z","modified":"2025-10-21T22:55:42.072Z","reserved":null,"kevAdded":["2024-10-23T00:00:00.000Z"],"kevDue":["2024-11-13T00:00:00.000Z"]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:U/RC:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:U/RC:C","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.94766,"percentile":0.9986,"severity":"critical","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":-0.30400000000000427,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.9507},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.9507,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.9507,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.9507,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.9507,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.9507,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.9507,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.9507,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.9507,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.9507,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.9507,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.94766,"percentile":0.9986}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.9507,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.9507,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.9507,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.9507,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.9507,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.94766,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.94766,"percentile":0.9986}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2024-10-23T00:00:00.000Z","dueDate":"2024-11-13T00:00:00.000Z","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","name":"Fortinet FortiManager Missing Authentication Vulnerability","description":"Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.","notes":[{"type":"url","href":"https://fortiguard.fortinet.com/psirt/FG-IR-24-423","label":"fortiguard.fortinet.com/psirt/FG-IR-24-423"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2024-47575","label":"nvd.nist.gov/vuln/detail/CVE-2024-47575"}],"vendor":"Fortinet","product":"FortiManager","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2024-10-23T00:00:00.000Z","dueDate":"2024-11-13T00:00:00.000Z","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","name":"Fortinet FortiManager Missing Authentication Vulnerability","description":"Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.","notes":[{"type":"url","href":"https://fortiguard.fortinet.com/psirt/FG-IR-24-423","label":"fortiguard.fortinet.com/psirt/FG-IR-24-423"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2024-47575","label":"nvd.nist.gov/vuln/detail/CVE-2024-47575"}],"vendor":"Fortinet","product":"FortiManager","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_9CADD4F5619B041E","name":"Exploit Reference (fortiguard.fortinet.com)","source":"reference","url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-423","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"MSF_EXPLOIT_LINUX_MISC_FORTIMANAGER_RCE_CVE_2024_47575","name":"Fortinet FortiManager Unauthenticated RCE","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/linux/misc/fortimanager_rce_cve_2024_47575.rb","maturity":"weaponized","reliabilityScore":1,"verified":true,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/linux/misc/fortimanager_rce_cve_2024_47575","rank":"600","rankName":"excellent","postAuth":false,"check":true,"stability":["crash-safe"],"sideEffects":["ioc-in-logs"],"reliability":["repeatable-session"]}}],"exploitCount":2,"weaknesses":[{"id":"CWE-306","name":"Missing Authentication for Critical Function","description":"The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/306.html"}],"affected":[{"vendor":"fortinet","product":"fortimanager","name":"FortiManager","label":"fortimanager","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 7.4.0, ≤ 7.4.4","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.2.0, ≤ 7.2.7","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, ≤ 7.0.12","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.4.0, ≤ 6.4.14","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.2.0, ≤ 6.2.12","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.2.0, < 6.2.13","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.4.0, < 6.4.15","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, < 7.0.13","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.2.0, < 7.2.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.4.0, < 7.4.5","noFixRecorded":false,"fixedIn":null},{"text":"7.6.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 7.4.0, ≤ 7.4.4 | ≥ 7.2.0, ≤ 7.2.7 | ≥ 7.0.0, ≤ 7.0.12 | ≥ 6.4.0, ≤ 6.4.14 | ≥ 6.2.0, ≤ 6.2.12 | ≥ 6.2.0, < 6.2.13 | ≥ 6.4.0, < 6.4.15 | ≥ 7.0.0, < 7.0.13 | ≥ 7.2.0, < 7.2.8 | ≥ 7.4.0, < 7.4.5 | 7.6.0","eol":null,"hubHref":"/vendor/fortinet/fortimanager"},{"vendor":"fortinet","product":"fortimanager_cloud","name":"fortimanager cloud","label":"fortimanager_cloud","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 6.4.1, ≤ 6.4.7","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.1, < 7.0.13","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.2.1, < 7.2.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.4.1, < 7.4.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 6.4.1, ≤ 6.4.7 | ≥ 7.0.1, < 7.0.13 | ≥ 7.2.1, < 7.2.8 | ≥ 7.4.1, < 7.4.5","eol":null,"hubHref":"/vendor/fortinet/fortimanager_cloud"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-423","label":"fortiguard.fortinet.com/psirt/FG-IR-24-423","hostname":"fortiguard.fortinet.com","tags":["Exploit","Mitigation","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-47575","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-47575","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2024-10-23T15:03:48.798Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2024-10-23T00:00:00.000Z","label":"Added to CISA KEV","detail":"Fortinet FortiManager Missing Authentication Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2024-11-13T00:00:00.000Z","label":"CISA remediation due","detail":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","source":"cisa"},{"kind":"modified","date":"2025-10-21T22:55:42.072Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T02:26:47.797Z","stale":false,"partial":false}}